nexus-agents 11.3.0 → 11.4.0

package/dist/{chunk-WDAND5YU.js → chunk-BDP422B2.js}

@@ -24,7 +24,9 @@ var SecurityFindingSchema = z.object({
   /** Scanner confidence (0-1). */
   confidence: z.number().min(0).max(1).default(0.5),
   /** Code snippet around the finding (optional). */
-  snippet: z.string().max(500).optional(),
+  snippet: z.string().optional(),
+  /** Scanner reported incompleteness or unusable truncation metadata; unsafe to match. */
+  snippetTruncated: z.boolean().optional(),
   /** Help URL for remediation guidance. */
   helpUrl: z.string().optional()
 });
@@ -43,4 +45,4 @@ export {
   SARIF_LEVEL_MAP,
   SEVERITY_ORDER
 };
-//# sourceMappingURL=chunk-WDAND5YU.js.map
+//# sourceMappingURL=chunk-BDP422B2.js.map

package/dist/{chunk-WDAND5YU.js.map → chunk-BDP422B2.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/security/sarif-types.ts"],"sourcesContent":["/**\n * SARIF Types and Security Finding Schema (#1682)\n *\n * Types for parsing SARIF (Static Analysis Results Interchange Format)\n * output from security scanners (Semgrep, CodeQL, Bandit, ESLint).\n * Normalizes findings into a unified schema for MCP tool consumption.\n *\n * @module security/sarif-types\n * (Source: Issue #1681, #1682 — Proactive Defensive Security)\n */\n\nimport { z } from 'zod';\n\n// ============================================================================\n// Unified Security Finding Schema\n// ============================================================================\n\n/**\n * Canonical 5-value finding-severity vocabulary (CVSS-aligned), most→least\n * severe. THE single source of truth — every 5-value finding-severity zod enum\n * (severity-consensus, finding-triage, agents/output-schemas, expert-types\n * VulnerabilitySeverity) and both SEVERITY_ORDER maps derive from this (#3570).\n * Tuple order is authoritative: SEVERITY_ORDER below maps it to ascending ranks.\n */\nexport const FINDING_SEVERITY_LEVELS = ['critical', 'high', 'medium', 'low', 'info'] as const;\n\n/** Severity levels aligned with CVSS and common scanner output. */\nexport const FindingSeveritySchema = z.enum(FINDING_SEVERITY_LEVELS);\nexport type FindingSeverity = z.infer<typeof FindingSeveritySchema>;\n\n/** A normalized security finding from any SARIF-compatible scanner. */\nexport const SecurityFindingSchema = z.object({\n  /** Unique finding ID (scanner-specific rule ID). */\n  id: z.string().min(1),\n  /** Scanner that produced this finding. */\n  scanner: z.string().min(1),\n  /** Rule identifier (e.g., 'javascript.lang.security.detect-eval'). */\n  rule: z.string().min(1),\n  /** Normalized severity. */\n  severity: FindingSeveritySchema,\n  /** Human-readable description of the finding. */\n  message: z.string().min(1).max(2000),\n  /** File path where the finding was detected. */\n  file: z.string().min(1),\n  /** Start line number (1-based). */\n  startLine: z.number().int().min(1),\n  /** End line number (1-based, optional). */\n  endLine: z.number().int().min(1).optional(),\n  /** CWE identifiers (e.g., ['CWE-79', 'CWE-89']). */\n  cweIds: z.array(z.string()).default([]),\n  /** Scanner confidence (0-1). */\n  confidence: z.number().min(0).max(1).default(0.5),\n  /** Code snippet around the finding (optional). */\n  snippet: z.string().max(500).optional(),\n  /** Help URL for remediation guidance. */\n  helpUrl: z.string().optional(),\n});\n\nexport type SecurityFinding = z.infer<typeof SecurityFindingSchema>;\n\n/** Result of parsing a SARIF file. */\nexport interface SarifParseResult {\n  /** Scanner name extracted from SARIF. */\n  readonly scanner: string;\n  /** Total findings parsed. */\n  readonly totalFindings: number;\n  /** Findings sorted by severity (critical first). */\n  readonly findings: readonly SecurityFinding[];\n  /** Parsing errors (non-fatal). */\n  readonly errors: readonly string[];\n}\n\n// ============================================================================\n// SARIF Input Types (subset of the SARIF 2.1.0 spec we need)\n// ============================================================================\n\n/** SARIF result level → our severity mapping. */\nexport const SARIF_LEVEL_MAP: Readonly<Record<string, FindingSeverity>> = {\n  error: 'high',\n  warning: 'medium',\n  note: 'low',\n  none: 'info',\n};\n\n/**\n * Severity order for sorting (lower = more severe). Derived from the canonical\n * tuple so it can never drift from {@link FINDING_SEVERITY_LEVELS} (#3570).\n */\nexport const SEVERITY_ORDER: Readonly<Record<FindingSeverity, number>> = Object.fromEntries(\n  FINDING_SEVERITY_LEVELS.map((level, index) => [level, index])\n) as Record<FindingSeverity, number>;\n"],"mappings":";AAWA,SAAS,SAAS;AAaX,IAAM,0BAA0B,CAAC,YAAY,QAAQ,UAAU,OAAO,MAAM;AAG5E,IAAM,wBAAwB,EAAE,KAAK,uBAAuB;AAI5D,IAAM,wBAAwB,EAAE,OAAO;AAAA;AAAA,EAE5C,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA,EAEpB,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA,EAEzB,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA,EAEtB,UAAU;AAAA;AAAA,EAEV,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAI;AAAA;AAAA,EAEnC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA,EAEtB,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC;AAAA;AAAA,EAEjC,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA;AAAA,EAE1C,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA;AAAA,EAEtC,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,QAAQ,GAAG;AAAA;AAAA,EAEhD,SAAS,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA;AAAA,EAEtC,SAAS,EAAE,OAAO,EAAE,SAAS;AAC/B,CAAC;AAqBM,IAAM,kBAA6D;AAAA,EACxE,OAAO;AAAA,EACP,SAAS;AAAA,EACT,MAAM;AAAA,EACN,MAAM;AACR;AAMO,IAAM,iBAA4D,OAAO;AAAA,EAC9E,wBAAwB,IAAI,CAAC,OAAO,UAAU,CAAC,OAAO,KAAK,CAAC;AAC9D;","names":[]}
+{"version":3,"sources":["../src/security/sarif-types.ts"],"sourcesContent":["/**\n * SARIF Types and Security Finding Schema (#1682)\n *\n * Types for parsing SARIF (Static Analysis Results Interchange Format)\n * output from security scanners (Semgrep, CodeQL, Bandit, ESLint).\n * Normalizes findings into a unified schema for MCP tool consumption.\n *\n * @module security/sarif-types\n * (Source: Issue #1681, #1682 — Proactive Defensive Security)\n */\n\nimport { z } from 'zod';\n\n// ============================================================================\n// Unified Security Finding Schema\n// ============================================================================\n\n/**\n * Canonical 5-value finding-severity vocabulary (CVSS-aligned), most→least\n * severe. THE single source of truth — every 5-value finding-severity zod enum\n * (severity-consensus, finding-triage, agents/output-schemas, expert-types\n * VulnerabilitySeverity) and both SEVERITY_ORDER maps derive from this (#3570).\n * Tuple order is authoritative: SEVERITY_ORDER below maps it to ascending ranks.\n */\nexport const FINDING_SEVERITY_LEVELS = ['critical', 'high', 'medium', 'low', 'info'] as const;\n\n/** Severity levels aligned with CVSS and common scanner output. */\nexport const FindingSeveritySchema = z.enum(FINDING_SEVERITY_LEVELS);\nexport type FindingSeverity = z.infer<typeof FindingSeveritySchema>;\n\n/** A normalized security finding from any SARIF-compatible scanner. */\nexport const SecurityFindingSchema = z.object({\n  /** Unique finding ID (scanner-specific rule ID). */\n  id: z.string().min(1),\n  /** Scanner that produced this finding. */\n  scanner: z.string().min(1),\n  /** Rule identifier (e.g., 'javascript.lang.security.detect-eval'). */\n  rule: z.string().min(1),\n  /** Normalized severity. */\n  severity: FindingSeveritySchema,\n  /** Human-readable description of the finding. */\n  message: z.string().min(1).max(2000),\n  /** File path where the finding was detected. */\n  file: z.string().min(1),\n  /** Start line number (1-based). */\n  startLine: z.number().int().min(1),\n  /** End line number (1-based, optional). */\n  endLine: z.number().int().min(1).optional(),\n  /** CWE identifiers (e.g., ['CWE-79', 'CWE-89']). */\n  cweIds: z.array(z.string()).default([]),\n  /** Scanner confidence (0-1). */\n  confidence: z.number().min(0).max(1).default(0.5),\n  /** Code snippet around the finding (optional). */\n  snippet: z.string().optional(),\n  /** Scanner reported incompleteness or unusable truncation metadata; unsafe to match. */\n  snippetTruncated: z.boolean().optional(),\n  /** Help URL for remediation guidance. */\n  helpUrl: z.string().optional(),\n});\n\nexport type SecurityFinding = z.infer<typeof SecurityFindingSchema>;\n\n/** A scanner-reported file parse gap, requiring comparison before it can be excused. */\nexport interface ScannerParseDiagnostic {\n  readonly file: string;\n  readonly kind: 'parse' | 'partial-parse';\n  /** Full diagnostic identity, including the location and unexpected syntax. */\n  readonly message: string;\n}\n\n/** Result of parsing a SARIF file. */\nexport interface SarifParseResult {\n  /** Scanner name extracted from SARIF. */\n  readonly scanner: string;\n  /** Total findings parsed. */\n  readonly totalFindings: number;\n  /** Findings sorted by severity (critical first). */\n  readonly findings: readonly SecurityFinding[];\n  /** Parsing errors (non-fatal). */\n  readonly errors: readonly string[];\n  /** False for capped/malformed findings or non-parse failures; inspect parseDiagnostics too. */\n  readonly coverageComplete?: boolean;\n  /** Attributable parse gaps, distinct from unusable results and non-parse errors. */\n  readonly parseDiagnostics?: readonly ScannerParseDiagnostic[];\n  /** Version measured from the scanner executable, when run by security_scan. */\n  readonly scannerVersion?: string;\n}\n\n// ============================================================================\n// SARIF Input Types (subset of the SARIF 2.1.0 spec we need)\n// ============================================================================\n\n/** SARIF result level → our severity mapping. */\nexport const SARIF_LEVEL_MAP: Readonly<Record<string, FindingSeverity>> = {\n  error: 'high',\n  warning: 'medium',\n  note: 'low',\n  none: 'info',\n};\n\n/**\n * Severity order for sorting (lower = more severe). Derived from the canonical\n * tuple so it can never drift from {@link FINDING_SEVERITY_LEVELS} (#3570).\n */\nexport const SEVERITY_ORDER: Readonly<Record<FindingSeverity, number>> = Object.fromEntries(\n  FINDING_SEVERITY_LEVELS.map((level, index) => [level, index])\n) as Record<FindingSeverity, number>;\n"],"mappings":";AAWA,SAAS,SAAS;AAaX,IAAM,0BAA0B,CAAC,YAAY,QAAQ,UAAU,OAAO,MAAM;AAG5E,IAAM,wBAAwB,EAAE,KAAK,uBAAuB;AAI5D,IAAM,wBAAwB,EAAE,OAAO;AAAA;AAAA,EAE5C,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA,EAEpB,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA,EAEzB,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA,EAEtB,UAAU;AAAA;AAAA,EAEV,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAI;AAAA;AAAA,EAEnC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA,EAEtB,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC;AAAA;AAAA,EAEjC,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA;AAAA,EAE1C,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA;AAAA,EAEtC,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,QAAQ,GAAG;AAAA;AAAA,EAEhD,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE7B,kBAAkB,EAAE,QAAQ,EAAE,SAAS;AAAA;AAAA,EAEvC,SAAS,EAAE,OAAO,EAAE,SAAS;AAC/B,CAAC;AAmCM,IAAM,kBAA6D;AAAA,EACxE,OAAO;AAAA,EACP,SAAS;AAAA,EACT,MAAM;AAAA,EACN,MAAM;AACR;AAMO,IAAM,iBAA4D,OAAO;AAAA,EAC9E,wBAAwB,IAAI,CAAC,OAAO,UAAU,CAAC,OAAO,KAAK,CAAC;AAC9D;","names":[]}

package/dist/{chunk-QOJPTGQI.js → chunk-C4ZXUDDS.js}

@@ -1,6 +1,6 @@
 import {
   FINDING_SEVERITY_LEVELS
-} from "./chunk-WDAND5YU.js";
+} from "./chunk-BDP422B2.js";
 import {
   assessReputation,
   sanitizeInput
@@ -479,4 +479,4 @@ export {
   createFailedReview,
   reviewPostingBlock
 };
-//# sourceMappingURL=chunk-QOJPTGQI.js.map
+//# sourceMappingURL=chunk-C4ZXUDDS.js.map

package/dist/{chunk-PIBIAVWQ.js → chunk-CVHLQFUX.js}

@@ -21,7 +21,7 @@ import {
   toolSuccess,
   withProgressHeartbeat,
   wrapToolWithTimeout
-} from "./chunk-BREDDYX4.js";
+} from "./chunk-XXNSAOCH.js";
 import {
   getToolMemory
 } from "./chunk-PPH3CAMR.js";
@@ -30,7 +30,7 @@ import {
 } from "./chunk-EZNIYU5T.js";
 import {
   VERSION
-} from "./chunk-3OQBXYFS.js";
+} from "./chunk-JEESPQIQ.js";
 import {
   ModelBoundAdapter,
   UNVERIFIABLE_STDERR_RE,
@@ -9915,4 +9915,4 @@ export {
   CONSENSUS_VOTE_TOOL_SCHEMA,
   registerConsensusVoteTool
 };
-//# sourceMappingURL=chunk-PIBIAVWQ.js.map
+//# sourceMappingURL=chunk-CVHLQFUX.js.map

package/dist/{chunk-ZZ2BEXLC.js → chunk-HF36DB2G.js}

@@ -7,7 +7,7 @@ import {
   VERSION,
   isNodeVersionSupported,
   recordServerTransport
-} from "./chunk-3OQBXYFS.js";
+} from "./chunk-JEESPQIQ.js";
 import {
   checkGatewayHealth,
   cliFailsVerdict,
@@ -2263,7 +2263,7 @@ async function runDoctorFix(result) {
   writeLine2("\u2500".repeat(40));
   let fixCount = 0;
   if (!result.dataDirectory.rootExists || result.dataDirectory.subdirectories.some((d) => !d.exists || !d.writable)) {
-    const { initDataDirectories: initDataDirectories2, describeDataDirFix: describeDataDirFix2 } = await import("./setup-data-dir-A37RQCGA.js");
+    const { initDataDirectories: initDataDirectories2, describeDataDirFix: describeDataDirFix2 } = await import("./setup-data-dir-UQOVBXCR.js");
     const outcome = describeDataDirFix2(initDataDirectories2());
     writeLine2(outcome.line);
     if (outcome.counted) fixCount++;
@@ -2383,4 +2383,4 @@ export {
   startStdioServer,
   closeServer
 };
-//# sourceMappingURL=chunk-ZZ2BEXLC.js.map
+//# sourceMappingURL=chunk-HF36DB2G.js.map